Security Certificates

What are Security Certificates and what are they used for?

• All sites you visit that have https:// in the address bar are encrypted using a certificate
• Security Certificates are a method of establishing trust and encrypting communication between different entities on a network
  • An entity can be a person or a computer
  • Certificates are issued to each entity, much like an identification card might be issued to each member of an organization
  • Each Certificate must be signed by a Certificate Authority, often referred to as the CA
    • Every certificate signed by the CA will have a trust relationship with every other certificate that is also signed by the same CA
  • When two certificates trust each other, they can be used to encrypt a connection
    • This is especially important when transmitting a username and password across the internet
• Every password protected service provided by Computerisms will use Security Certificates to encrypt network connections

So why do I get a Security Certificate Warning?

• Certificate warnings can be caused by several factors, but the most important thing to know is that just because you see a warning does not mean the connection is not encrypted
• One possible reason for the Certificate Warning is that your computer does not know the origin of the certificate on the server
  • When you go to an https enable site that does not show the warning, it is because a purchased certificate on the server and a certificate on your computer have been signed by the same CA
  • When one generates his own Certificates instead of purchasing them, as Computerisms does, they are considered Self-Signed.
  • Since Computerisms uses self-signed certificates and doesn't pay the fees to have its certificates signed by the same CA used by your computer, your computer will not trust the server's certificate
    • A person with the right knowledge can set up a system that is just as secure at a fraction of a fraction (yes, a fraction of a fraction) of the cost of purchasing certificates
    • Using paid Certificates on a Hosting Server that is hosting many domains is prohibitively expensive
  • Since your computer cannot verify the origin of the certificate on the server, it cannot establish a trust relationship with the server
    • The warning will inform you that the certificate on the server cannot be trusted because its origins cannot be confirmed
    • Since you know the origins of the certificate (It comes from Computerisms), you can override your computer's paranoia
  • By temporarily overriding the warning, you instruct your computer to trust the certificate on the server
  • Once the trust is established, then the certificates can be used to encrypt the communication so your password is not transmitted in clear text
  • Installing the Computerisms CA on your computer will make it so your computer trusts the server's certificate without throwing a warning
• Another reason a security certificate warning might pop up is a mismatched address
  • Computerisms Webmail is one site that answers to many names, such as https://webmail.domain.tld
  • If you arrive at the site by a name that is different than the one on the certificate, your computer will warn you that the address in your address bar is not the same as the address on the certificate.
    • This might happen if you are using an IP address to connect, or are otherwise subverting normal operations
  • Computerisms endeavours to make sure all of its customer's names are on the certificate, so this problem should not be seen when connecting to Computerisms Services
    • If you do see this problem, it is the result of a typo or other accidental misconfiguration. Please notify us if you see this
• Remember, regardless of the warning, when you instruct your computer to trust the certificate, encryption will still happen. So long as you know the certificate you will know who you are connecting too, even if your computer doesn't, so you will be sending your passwords over the internet encrypted in such a way that other people can't see it. You should not send a password on an unencrypted connection.

Okay, Now I know why, but what do I do about it?

• If one extra click every time you use a Computerisms Service does not seem unreasonable, then one viable option is to do nothing
• In some cases, the problem can be solved on the server.
  • In the case of providing encrypted services in a hosting environment, purchasing certificates is very cost prohibitive for a hosting company
    • it is better to have a certificate and provide education regarding the warning than it is to have no certificate at all.
      • Without the certificate, we cannot encrypt the transmission of your password
  • you can purchase a certificate and Computerisms will install it for you
  • Computerisms can assist with the acquisition of a certificate, please contact us for information
• You can import the CA into your system so as to put a certificate on your machine that will recognize and trust the certificate on the server
• If you use Internet Explorer, you can import the CA to establish trust
• Firefox is probably the easiest browser to deal with, Just add a Security Certificate Exception for any site or Computerisms Service that gives you the error
  • You can also import the CA to bypass all future occurrences of the Security Certificate Warning
• For Google Chrome, you can import the CA through internet explorer to bypass the Security Certificate Warning

Internet Explorer - Importing Certificate Authority

The easiest way to install a certificate is using Internet Explorer Open your start menu and choose "All Programs" In the list, right click Internet Explorer In the menu, choose "Run as Administrator" If you are presented with a window confirming the program should be allowed to make changes to your computer, select Yes
	Navigate to https://rc.domain.tld or any other encrypted Computerisms service Here is a list of sites you can use to get the certificate https://rc.domain.tld https://sm.domain.tld https://cal.domain.tld https://fetch.domain.tld Select "Continue to this website (not recommended)" For the record, it is recommended this time...
In the next window, you will notice the address bar goes red. Click in the address bar where the X is displayed as a certificate warning
	In the small window that opens up, click the link at the bottom called "View certificates"
In the next window, find the tab called "Certification Path" and click it Click on the line that says Computerisms Certificate Authority Then click the "View Certificate" Button.
	In the next window, click the button called "Install Certificate" Note: if you did not run Internet Explorer as Administrator, this button will not show up
The next window will be the start of the Certificate Import Wizard Click Next
	Move the Radio button to be beside "Place all Certificates in the following store" Click the browse button to open the navigation window In the navigation window, select "Trusted Root Certification Authorities" Click OK, then click Next
Click the Finish button
	Another warning window will pop up, click Yes in the bottom right corner
A window will pop up confirming the import was successful, click OK on that window Click OK on the Computerisms Certificate Authority Certificate Window Click OK on the first Certificate Window

Firefox - Create Security Exception

Open Firefox and navigate to a site that will generate the Security Certificate warning, such as https://rc.computerisms.ca Click on the link called "I understand the risks" Click on the button called Add Exception
	Click the "Confirm Security Exception" button If the button is greyed out, give it a few seconds and it should come back

Firefox - Import Certificate Authority

• Before you begin:
  • You must have imported the CA into Internet Explorer

Open Internet Explorer and click the tools icon Select Internet Options from the list
	Select the Content tab Click the Certificates Button
Select the Trusted Root Certification tab Find "Computerisms Certificate Authority" under the "Issued To" column Click the Export button
	In the next window that opens up, click Next
In the following window, leave everything the way it is and click Next
	In the next window, click the Browse button In the Browser window that opens up, select a place to save your file If you are not sure where to put it, use your Desktop Enter a file name If you are unsure what to enter, put Computerisms Certificate Authority Click the Save button Then click the Next button
Click Finish When the Alert window stating the export was a success, click OK Click Close on the Certificates Window Click OK on the Internet Options Window
	Open Firefox In the top left corner of the window, click the Firefox Button Click Options
Click the Advanced Icon in the top right of the window Select the Encryption tab Click the View Certificates Buttonhelp
	In the new window, select the Authorities tab Click the Import Button
In the Browsing Window, navigate to where you save the Computerisms Certificate Authority If you followed above, it is on your Desktop Click Comptuerisms Certificate Authority, then click Open Or double-click Computerisms Certificate Authority
	In the new window, select "Trust this CA to identify websites" Click OK Click OK on the Certificate Manager Click OK on the Options Window